From a7ffa73f48dd6afff74f89184f2fb4fc828d4d9f Mon Sep 17 00:00:00 2001 From: Wei Tang Date: Tue, 11 May 2021 23:23:09 +0200 Subject: [PATCH] Add security advisory for evm crate related to memory over-allocation (#909) --- crates/evm/RUSTSEC-0000-0000.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 crates/evm/RUSTSEC-0000-0000.md diff --git a/crates/evm/RUSTSEC-0000-0000.md b/crates/evm/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..dd4c2b5 --- /dev/null +++ b/crates/evm/RUSTSEC-0000-0000.md @@ -0,0 +1,20 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "evm" +date = "2021-05-11" +url = "https://github.com/rust-blockchain/evm" +categories = ["denial-of-service"] + +[versions] +patched = [">= 0.26.1", "0.25.1", "0.24.1", "0.23.1", "0.21.1"] +``` + +# Denial of service on EVM execution due to memory over-allocation + +Prior to the patch, when executing specific EVM opcodes related +to memory operations that use `evm_core::Memory::copy_large`, the `evm` +crate can over-allocate memory when it is not needed, making it +possible for an attacker to perform denial-of-service attack. + +The flaw was corrected in commit `19ade85`. \ No newline at end of file